Thanks! I'm looking into and testing this now. I'll let you know how I make out. ... View more

This is in our inputs.conf file in our deployment app. [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist3 = EventCode="8004" Workstation_name=”SERVERNAME*” blacklist4 = EventCode="8004" Workstation_name=”OTHERSERVERNAME*” index = wineventlog renderXml=false ... View more

Sure: 08/26/2019 12:34:20 PM LogName=Microsoft-Windows-NTLM/Operational SourceName=Microsoft-Windows-Security-Netlogon EventCode=8004 EventType=4 Type=Information ComputerName=####### User=NOT_TRANSLATED Sid=##### SidType=0 TaskCategory=Auditing NTLM OpCode=Info RecordNumber=##### Keywords=None Message=Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller. Secure Channel name: ######## User name: ########## Domain name: NULL Workstation name: ######### Secure Channel type: 2 Audit NTLM authentication requests within the domain NULL that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to any of the Deny options. If you want to allow NTLM authentication requests in the domain NULL, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled. If you want to allow NTLM authentication requests to specific servers in the domain NULL, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in the domain NULL to which clients are allowed to use NTLM authentication. ... View more

I'm having this exact issue on 2008 R2 as well as 2012 R2 with both 6.5.2 and 6.5.3 (see below) and it's holding up a good chunk of installations. Have you had any luck? 4-28-2017 10:14:38.923 -0400 WARN DC:PhonehomeThread - Phonehome thread is now shutdown. ... View more

Thanks, I actually ended up going the props/transforms route but definitely going to move to having a syslog server collecting and forwarding to my indexer. ... View more

Thanks for the reply. A have a few questions 1) Which inputs file am I adjusting? C:\Program Files\Splunk\etc\system\local? 2) I have 13 hosts does that mean I have to put in 13 stanzas or can I use a wildcard? I think I was under the impression that you install the TA and it takes care of the rest. ... View more

Hi, Thanks for your help. I had been setting it to the wrong sourcetype, cisco:esa, which was renaming it to cisco:esa:legacy and in turn using a different set of field extractions. This is why none of the panels in the Cisco Security Suite were populating data. I got it going by adding the stanza to my props.conf file to set the sourcetype as cisco:esa:textmail : [host::Host-IP-Address] TRANSFORMS-changesourcetype = cisco_esa_textmail_sourcetype and then added this stanza to my transforms.conf file: [cisco_esa_textmail_sourcetype] REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(Host-IP-Address)[\w.-]]?\s FORMAT = sourcetype::cisco:esa:textmail DEST_KEY = MetaData:Sourcetype Thanks again! ... View more

Hi, I've tried both of the above methods and I'm still receiving the syslog data as sourcetype syslog with no fields. I have to be missing a step. Here's what I have done: • Our Messaging Team configured the IronPort to send mail_logs to our indexer via syslog. • I installed the Splunk Add-on for Cisco ESA. • Added the all stanzas contained in the props.conf and transforms.conf C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco-esa\default to the props.conf and transforms.conf located in C:\Program Files\Splunk\etc\system\local. • Restarted Splunk. ... View more

I saw that earlier, but the machines are Windows 7 and I checked all permissions. The weird thing is that there weren't any problems with the 6.0.1 version of the Universal Forwarder. ... View more

Ugg, that was one of the missing pieces. It was on a rebuilt system that blew away the sccm_user role. So now I have data in the dashboards, but still missing the sccm:installed_software and eventtype="sccm_change_audit" data. I'll keep digging and let you know what I find. Thank you for your help. ... View more

Thanks for the info. I do have the sccm and sccm_status indexes and they are being written to. I also verified the inputs I pasted in the dbx/local/inputs.conf. Then I checked the log and it looks as though there aren't any errors. All the database monitors are executing fine with no failures. I did notice that by default, the sccm and sccm_status are not being searched when I open the Query String in the panels. I confirmed that in the sccm_user role, both were listed in the Indexes searched by default. I've never run into this before. I don't think I have anything set to override this setting. ... View more

Thanks I will have a look. The vendor did say they would give me their API, so I'll start there. I'll let you know how I make out. Thanks! ... View more

Thanks. I will check it out. ... View more

Correct. I should have clarified this is simply for the forwarders. We do not plan to remotely manage them through the management web interface (remote management disabled by default anyway) and want to close any unnecessary ports for security reasons. ... View more